Guardrails for AI apps and agents: what they catch, what they cost, and what matters more

Once your chatbot or agent is in front of customers, strangers can type anything into it, and every web page, email or document it reads can carry instructions of its own. Guardrails are the checks that sit around the model and screen that traffic. They are worth having and can be cheap, but none of them will save an agent that has been given more power than its job needs.

This post is about AI features and agents you ship to users. If your worry is a coding agent on a developer's machine, our guide to securing coding agents covers sandboxes, command guards and CI gates for that case. Every figure below comes from our reviews or from the vendor and research documents they cite; we have not run these tools ourselves.

What a guardrail actually catches

Four problems account for most of what these products are sold against. The OWASP Top 10 for LLM Applications is a useful checklist, and guardrails deal most directly with three of its entries: prompt injection (LLM01), sensitive information disclosure (LLM02) and excessive agency (LLM06).

• Prompt injection. Text that tries to replace your instructions with someone else's. The direct kind comes from the user. The indirect kind hides in a retrieved page, an email or a tool result, and it is the one that hurts agents, because the model reads it as part of its work.
• Jailbreaks. Attempts to talk the model out of its safety rules, often spread over several turns of a conversation.
• Unsafe output. Harmful or off-policy answers, and answers that claim things the retrieved documents do not support.
• Data leakage. Personal data, secrets or your system prompt leaving in a reply, or a link in a reply that points somewhere it should not.

No product covers all four equally well. An injection detector flags text that looks like instructions, not harm: Meta's card for Llama Prompt Guard 2 notes that documentation quoting "ignore previous instructions" will trip it. A moderation model that scores violence will not notice a polite instruction hidden in a supplier's PDF. Match each check to a risk before you buy anything.

Three kinds of guardrail

Safety models you host

These are open-weight models you run next to your own. Text never leaves your machines and there is no fee per check; in exchange you own the GPU, the upgrades and the tuning.

• Llama Prompt Guard 2 (4.2) is the cheap injection filter. Its 86M model catches 97.5% of attacks on Meta's private jailbreak set at a 1% false-positive rate. On AgentDojo, a benchmark where attackers plant instructions in an agent's tools, it stops 81.2% at a 3% cost in completed tasks. It reads 512 tokens at a time, so long pages must be split into chunks, and the download is gated behind the Llama 4 Community License.
• Qwen3Guard (4.3) is the multilingual moderation model: 119 languages and dialects, sizes from 0.6B to 8B, Apache 2.0. It labels text safe, controversial or unsafe, so a children's app and an adult fiction site can share one model and differ only on what "controversial" means. A Stream variant checks the answer token by token while it is written.
• Granite Guardian 4.1 (4.0) is IBM's 8B judge. Beyond harm, it checks whether an answer is grounded in the retrieved text and whether an agent's function call fits the tools it was given. It is English only, and IBM positions it for monitoring and spot checks rather than every message.
• gpt-oss-safeguard (4.0) takes a policy you write in plain language and returns a decision with its reasoning, so a trust and safety team can change a rule without labelling new training data. It is slower and heavier than a classifier, the 20b needs a 16 GB GPU, and OpenAI warns the visible reasoning can be hallucinated.

Cloud guardrail APIs

A hosted service runs and updates the detectors. You send each prompt and reply over the network and get a verdict back, trading a new data processor and a network hop for not running models yourself.

• Google Model Armor (4.2) screens for injection, harmful content, sensitive data and bad links at $0.10 per million tokens, with the first 2 million each month free. It works with models outside Google Cloud. It judges each request alone, with no memory of the conversation, and does not decode Base64.
• Azure AI Content Safety (4.1) scores harm in text and images, and its Prompt Shields check both user prompts and documents for injected commands. The standard tier costs $0.375 per 1,000 text records of up to 1,000 characters. Microsoft says inputs are not stored or used for training; Prompt Shields are trained mainly on English.
• Lakera Guard (4.0), now sold by Check Point, accepts a whole OpenAI-style chat, tool calls included, and screens the latest exchange. The free tier covers 10,000 requests a month; beyond that there is no published price.

Guardrail frameworks

A framework is not a detector. It is the plumbing that runs checks at each point in your app and decides what to do with the result; you plug models or APIs into it.

• NVIDIA NeMo Guardrails (4.0) has separate rails for input, output, retrieval and tool execution, and plugs in Llama Guard, NVIDIA's NemoGuard models, Presidio and commercial detectors. It asks for real configuration in YAML and its own Colang language, its 0.24.0 release listed six breaking changes, and anonymous telemetry to NVIDIA is on by default.
• LlamaFirewall (3.8) is Meta's layered design: Prompt Guard 2 on inputs and tool output, AlignmentCheck reading the agent's reasoning for signs it has been hijacked, and CodeShield scanning generated code. Its paper is the best public evidence that layers work; the package itself has had no release since May 2025.
• Guardrails AI (3.2) is the cautionary tale. Its hosted Hub closed on 25 August 2026, the team joined Harvey, nothing has been merged since, and a malicious 0.10.1 release reached PyPI in May. Its offline validators for regex, schema and length still run; new projects are better served elsewhere.

How much layers buy

The clearest numbers come from Meta's LlamaFirewall paper, measured on AgentDojo. With no guardrail, 17.6% of attacks succeeded. Prompt Guard 2 alone cut that to 7.5%. AlignmentCheck, which asks a large model whether the agent is still doing what the user asked, cut it to 2.89%. Both together reached 1.75%, while the share of tasks the agent completed fell from 47.7% to 42.7%.

Two lessons follow. A fast filter and a slower reasoning check miss different attacks, so they compound. And protection costs usefulness as well as money: by our arithmetic, about one task in ten that used to succeed no longer did.

Latency and cost in the request path

Every check you put before the answer adds time, and an agent may run several per turn: the user's message, each retrieved document, each tool result and the final reply. Count checks per turn, not per conversation.

Check	Published latency	Cost
Prompt Guard 2, 22M	19.3 ms per 512 tokens on an A100	Your GPU
Prompt Guard 2, 86M	92.4 ms per 512 tokens on an A100	Your GPU
CodeShield first pass	About 60 ms	Your CPU or GPU
AlignmentCheck	About 860 to 1,490 ms per step in the paper's trace	One large-model call per audited step
Lakera Guard	Under 50 ms (vendor claim)	Free to 10,000 requests a month, then a quote
Google Model Armor	Not stated in our sources	$0.10 per million tokens
Azure AI Content Safety	Not stated in our sources	$0.375 per 1,000 text records

At those prices, screening a million short chat messages costs a few dollars on Model Armor and $375 on Azure. A billion tokens a month on Model Armor is about $100, or nothing inside the 3 billion included with a Security Command Center Enterprise or Premium subscription. Lakera counts each screened item as a request, so an agent that checks the prompt, two documents and the reply spends four per turn and exhausts the free tier at 2,500 turns.

Self-hosting moves the bill to hardware. Open models carry no fee, but someone pays for the GPUs, and NVIDIA AI Enterprise, which covers the NeMo Guardrails microservice, lists at $4,500 per GPU per year.

Three habits keep the delay down. Run the cheap classifier on everything and send only risky steps to the slow judges; OpenAI describes the same pattern for gpt-oss-safeguard, with fast classifiers first and a share of traffic sent to the reasoning model. Run independent checks in parallel, which is what NeMo's IORails engine does for NemoGuard checks. And for streamed answers, check as the text arrives: Qwen3Guard's Stream variant scores each token, and Lakera asks for chunks of at least 10 tokens.

False positives are the real tuning work

Every detector trades missed attacks against blocked customers, and vendor accuracy figures come from the vendor's own test sets. Lakera ships every detector at L4, its strictest level, and calls its default policy "intentionally strict". Meta says Prompt Guard 2's accuracy depends on what normal traffic looks like in your application and recommends fine-tuning on your own data.

Before you block anything, run a few hundred real, harmless requests and a set of known attacks through the guard and record both the block rate and the miss rate at each threshold. Then go live in log-only mode, which Lakera calls Detect mode, and read what it flags for a week or two. Decide in advance what a block looks like to the user: a plain refusal with a way to reach a person is better than a silent failure. Qwen3Guard's controversial label gives you a third option between allow and block, which is to send the case to a review queue.

Where red-teaming and supply-chain scanning fit

Guardrails act on live traffic. Red-teaming attacks your app before users do and tells you whether the guardrails work; supply-chain scanning checks the code and tools your app trusts. You need all three, at different moments.

• Choosing a model. CyberSecEval (3.9) measures how often a bare model writes vulnerable code or obeys injected text. It does not see your prompts, tools or retrieval, so it belongs next to the model card, not in place of testing the app.
• Before launch and after every change. garak (4.3) fires a library of published attacks at an endpoint; point it at the deployed app with its guardrails in front, because the system prompt and filters change the result. promptfoo (4.5) puts red-team tests in a YAML file that runs in CI. DeepTeam (3.9) covers agent risks such as authorisation bypass and poisoned tool descriptions.
• Patient attackers. PyRIT (4.2) runs multi-turn attacks such as Crescendo, where an attacker model escalates slowly. That is exactly the case a screen that judges one request at a time is built to miss.

Feed what the red team finds back into the guard thresholds and, more often, into the tool permissions.

The guardrails themselves are part of your supply chain. Guardrails AI's malicious 0.10.1 is one example; in March 2026 attackers also published two poisoned LiteLLM releases to PyPI using stolen maintainer credentials. Pin exact versions and hashes for guard libraries, gateways and SDKs, and scan them with the rest of your code: Semgrep (4.3) as a required check on pull requests, and Snyk (4.0) for dependencies and containers, whose free plan stops at 100 Snyk Code tests a month. For the MCP servers and skills your agent loads, Snyk Agent Scan (3.8) looks for instructions hidden in tool descriptions, and sends those descriptions to Snyk to do it.

Least privilege matters more than any filter

The best layered result above still let 1.75% of attacks through, on a benchmark whose attacks were known in advance, and Meta warns that attackers adapt to classifiers. Plan for the injection that gets past every filter, and ask what it can do next. The answer is set by the tools you gave the agent, not by the guard.

• Act as the user, not as a service account. When a tool call carries the signed-in user's identity, an injected instruction cannot fetch data that user could not see. Check authorisation in your code, never in the prompt.
• Give each tool the narrowest credential. An agent that answers questions about orders needs a read-only view of one customer's orders, not the database.
• Put a person in front of what cannot be undone. Payments, deletions and messages to outside addresses should wait for a confirmation the model cannot give itself.
• Limit where data can go. An agent that can fetch any URL can send your data to any URL.
• Isolate the tools. ToolHive (4.1) runs each MCP server in its own container with none of your local credentials, adds identity-based access policy per request and keeps audit logs. Its review is clear that containment does not stop a server misusing access you grant on purpose. When an agent runs code, OpenSandbox (4.1) hands it a disposable sandbox through an API, but it is an ordinary container unless you configure gVisor, Kata or Firecracker, and it runs unauthenticated if no API key is set.
• Log every tool call with the user, the input and the result, so an incident can be traced.

A starting setup for a small team

Picture five people shipping a support chatbot or a small agent on one cloud, with nobody whose job title says security.

1. Permissions first. List every tool, give each the narrowest credential, and add a confirmation step before anything that sends, pays or deletes. This costs an afternoon and does more than any product below.
2. One hosted screen on user input, retrieved documents and replies: Model Armor if you are on Google Cloud or no cloud in particular, Azure AI Content Safety if you already run on Azure. Lakera's free tier suits a prototype. If you already run GPUs, Prompt Guard 2 22M on tool output is close to free, and Qwen3Guard 0.6B is the cheapest multilingual moderation model to serve.
3. Log-only for two weeks, then switch on blocking at thresholds you have checked against your own traffic.
4. A red-team file in CI. A promptfoo config that runs on every prompt or model change, and a narrowed garak scan after a model swap.
5. Pinned dependencies and Semgrep as a required check on pull requests.

The software here is free or nearly so. The bills are per-request screening and the model tokens the red-team runs consume.

A starting setup for a regulated enterprise

A bank, insurer or health provider has the same risks plus auditors, data residency rules and a vendor review for every new processor.

1. Identity-bound tools. Agents act with the user's identity. MCP servers run behind ToolHive for per-request policy, isolation and audit logs, and generated code runs in OpenSandbox with a secure runtime and an API key configured.
2. One control point. NeMo Guardrails with rails on input, retrieval, tool execution and output, a pinned version, telemetry off with DO_NOT_TRACK=1, and require_iorails=True so configurations the fast engine cannot run fail loudly instead of falling back silently to the older one.
3. Detectors that meet your data rules. Self-hosted Prompt Guard 2 on every input and tool result; Qwen3Guard for multilingual moderation, or Granite Guardian where English is enough and you want grounding and function-call checks under Apache 2.0. If a cloud API is allowed, prefer the one already approved: Azure keeps processing in the region you choose for most checks and supports customer-managed keys, and Google says Model Armor discards content after each check unless logging is on. Lakera offers air-gapped self-hosting on Enterprise. Note that several Azure preview features, groundedness detection among them, retire on 30 April 2027.
4. Slow judges where they pay. gpt-oss-safeguard for policy decisions and appeals that need a written rationale, and an AlignmentCheck-style audit on high-risk agent steps, using a large model you already have a contract for.
5. Evidence of testing. CyberSecEval at model selection, DeepTeam's OWASP presets to show an auditor what was tested, and PyRIT in the hands of a dedicated red-teamer for multi-turn attacks. Re-run after every model, prompt, guard or tool change, and keep the transcripts.
6. Supply chain and ownership. Pinned hashes, Semgrep and Snyk in CI, Snyk Agent Scan on new MCP servers once your data protection officer has cleared sending tool descriptions to Snyk. This market changes hands quickly: Lakera now belongs to Check Point, promptfoo to OpenAI, and Guardrails AI's hosted service is gone. Keep every guard behind your own interface so it can be swapped.

The catch: most guardrails see text one piece at a time, and attackers know it. Model Armor has no memory of the conversation, does not decode Base64 and skips oversized inputs rather than flagging them. Prompt Guard 2 reads 512 tokens, so an attack split across chunks can slip through. Azure's Prompt Shields stop at 10,000 characters for the prompt and 10,000 across up to five documents. Outside English, most of these lose ground. Judge a filter by what it costs and how often it is wrong, never by whether it is complete.

Our take: guardrails are the doorman and permissions are the locks on the rooms. A doorman turns away most trouble and the occasional regular, while the locks decide how much damage the one who slips past can do. Fit the locks first, hire the cheapest doorman who speaks your customers' languages, and send the expensive judges only to the doors that matter.